[Touch-packages] [Bug 2019010] Re: environment variable SSH_ORIGINAL_COMMAND on server side set with wrong value

2023-07-12 Thread Sergio Durigan Junior
Hello Andrey, This seems to be more of a support question than a bug per se, so I am keeping this bug marked as Expired. There are many places where you can obtain help for the questions you are having; you can take a look at https://www.ubuntu.com/support/community and choose one of the

[Touch-packages] [Bug 2019010] Re: environment variable SSH_ORIGINAL_COMMAND on server side set with wrong value

2023-07-10 Thread Launchpad Bug Tracker
[Expired for openssh (Ubuntu) because there has been no activity for 60 days.] ** Changed in: openssh (Ubuntu) Status: Incomplete => Expired -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssh in Ubuntu.

[Touch-packages] [Bug 2019010] Re: environment variable SSH_ORIGINAL_COMMAND on server side set with wrong value

2023-05-11 Thread Andrey
Hello I so that when it using scp with -O option " Use the legacy SCP protocol ..." it is working. The problem is that it is not always possible to force client to use additional switch. it is many cases when SSH_ORIGINAL_COMMAND is checked on server and additional decision is made on it . Is

[Touch-packages] [Bug 2019010] Re: environment variable SSH_ORIGINAL_COMMAND on server side set with wrong value

2023-05-11 Thread Paride Legovini
Hello Andrey, that's expected as from openssh 9.0 scp actually uses sftp. From the release notes [1]: This release switches scp(1) from using the legacy scp/rcp protocol to using the SFTP protocol by default. The release notes then shortly elaborate on why legacy scp was problematic. I'm

[Touch-packages] [Bug 2019010] Re: environment variable SSH_ORIGINAL_COMMAND on server side set with wrong value

2023-05-10 Thread Eduardo Barretto
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross